McAfee Data Loss Prevention 9.2.2 Product Guide

2Using McAfee DLP MonitorFinding incidents using keywords and concepts2 Enter keywords in one of two ways:• On the Basic Search menu, type one or more keywords, and click Search.• On the Advanced Search page, open the Content category, type one or more keywords, and clickSearch.Find incidents by excluding keywordsExclude keywords from a query to keep from retrieving incidents that contain them.An exclusion search could result in too many hits. Limit the query by adding more parameters.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting | Advanced Search..• On your McAfee DLP appliance, select Capture | Advanced Search.2 Open the Content category.3 Select Keywords | contains none of and enter one or more keywords in the value field.4 Click Search or Save as Rule.Find exact keyword matchesFind exact keywords or UTF‐8 characters by using the Exact Phrase condition. With this condition, youcan use logical operators to extend your query.UTF‐16 characters cannot be found using this feature.Because search is case‐insensitive, you need not capitalize the keywords. Do not add quotation marksand parentheses; they are added by the search engine.In Exact Match, word stemming takes precedence. For example, if you search for information, thekeyword will be stemmed to inform, which will return all strings that contain that stem word. Includeadditional words in your query to find the word to prevent stemming.Word stemming queries do not require any notation. Do not use asterisks or tildes.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting | Advanced Search.• On your McAfee DLP appliance, select Capture | Advanced Search.2 Open the Content category.3 Select Keywords | exact phrase and type the keywords to be matched into the value field.4 Click Search or Save as Rule.42 McAfee Data Loss Prevention 9.2.2 Product Guide